Exploit a permission-backed mount, NFS mapping or local service

Needs: Relevant export/mount options or service authentication; effective identity, writable path and any privileged execution consumer

Shell commands

# Baseline
findmnt
cat /etc/fstab
mount
ss -lntup
ss -lxnp

For NFS, a writable export plus no_root_squash can trust client-root-created ownership/SUID metadata. Confirm export options, writable mount, target-side mount options and compatible execution. See NFS/RPC.

Root-only loopback services and UNIX sockets are candidates only. Identify protocol/authentication and prove a privileged action through a controlled request, configuration, plugin or file.

Verify → Verify the actual file/service operation, mapped identity and any resulting execution effect.

If it fails → An exposed export or listener is only a candidate. Validate mapping, authentication and consumer before claiming escalation. More detail ↓

If → then

RPC/NFS listeners or export information → Inspect RPC/NFS exports and effective file identity
Needs: Reachable RPC/NFS transports, permitted client address and an export whose UID/GID mapping grants relevant access
A MySQL-compatible service and valid application/database credentials → Use MySQL/MariaDB data and file primitives
Needs: Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions
SSH reaches a server that can access the needed internal service → Forward a selected service through an SSH client-side listener
Needs: Accepted SSH identity and forwarding policy; local listener availability and SSH-server-to-destination route

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Exploit a permission-backed mount, NFS mapping or local service

USE WHEN: A writable/exported filesystem or a loopback-only service with useful privileges
STARTING ACCESS: A verified Linux foothold with a known effective UID, groups and filesystem context
RESULT: A useful file/credential operation or verified local service access

Recognize the clue

Inspect mounts, exports and local listeners after the foothold; correlate each with its identity and reachable service.

findmnt
cat /etc/exports 2>/dev/null
ss -lntup

SYNTHETIC EXAMPLE OUTPUT

Listener: 127.0.0.1:DATABASE_PORT
Export option candidate: no_root_squash

Means: A local-only service or export mapping creates a specific investigation route, not automatic escalation.

Confirm: For the service check accepted identity/rights; for NFS check client mapping, write permissions, mount flags and target-side consumer.

After validation: The complete mapped-file or authenticated local-service primitive is verified: select it.
Ruled out in this context: root_squash/nosuid or insufficient service rights defeats the proposed privileged chain.
Still inconclusive: Export text or a listen socket without actual access leaves the candidate incomplete.

Troubleshooting: An exposed export or listener is only a candidate. Validate mapping, authentication and consumer before claiming escalation.

Additional prerequisite checks

findmnt
cat /etc/exports 2>/dev/null
ss -lntup
ss -lxnp

For NFS, a writable export plus no_root_squash can trust client-root-created ownership/SUID metadata. Confirm export options, writable mount, target-side mount options and compatible execution. See NFS/RPC.

Root-only loopback services and UNIX sockets are candidates only. Identify protocol/authentication and prove a privileged action through a controlled request, configuration, plugin or file.

Why it works

A new mount or local listener changes reachable objects, not automatically privilege. NFS numeric-ID mapping, squash options and local service rights must be tested in their actual context.

Worked example · hypothetical

Observation: a loopback database is inaccessible externally. Test: identify its credentials and access it locally or through a justified forward. Illustrative output: data reads succeed as a limited DB user. Interpretation: follow the database's actual rights.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗